1 /* $NetBSD: iptable.c,v 1.5 2014/12/10 04:37:58 christos Exp $ */
2
3 /*
4 * Copyright (C) 2007-2009, 2013 Internet Systems Consortium, Inc. ("ISC")
5 *
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
11 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
12 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
13 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
14 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
15 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
16 * PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 /* Id: iptable.c,v 1.15 2009/02/18 23:47:48 tbox Exp */
20
21 #include <config.h>
22
23 #include <isc/mem.h>
24 #include <isc/radix.h>
25
26 #include <dns/acl.h>
27
28 static void destroy_iptable(dns_iptable_t *dtab);
29
30 /*
31 * Create a new IP table and the underlying radix structure
32 */
33 isc_result_t
dns_iptable_create(isc_mem_t * mctx,dns_iptable_t ** target)34 dns_iptable_create(isc_mem_t *mctx, dns_iptable_t **target) {
35 isc_result_t result;
36 dns_iptable_t *tab;
37
38 tab = isc_mem_get(mctx, sizeof(*tab));
39 if (tab == NULL)
40 return (ISC_R_NOMEMORY);
41 tab->mctx = NULL;
42 isc_mem_attach(mctx, &tab->mctx);
43 isc_refcount_init(&tab->refcount, 1);
44 tab->radix = NULL;
45 tab->magic = DNS_IPTABLE_MAGIC;
46
47 result = isc_radix_create(mctx, &tab->radix, RADIX_MAXBITS);
48 if (result != ISC_R_SUCCESS)
49 goto cleanup;
50
51 *target = tab;
52 return (ISC_R_SUCCESS);
53
54 cleanup:
55 dns_iptable_detach(&tab);
56 return (result);
57 }
58
59 isc_boolean_t dns_iptable_neg = ISC_FALSE;
60 isc_boolean_t dns_iptable_pos = ISC_TRUE;
61
62 /*
63 * Add an IP prefix to an existing IP table
64 */
65 isc_result_t
dns_iptable_addprefix(dns_iptable_t * tab,isc_netaddr_t * addr,isc_uint16_t bitlen,isc_boolean_t pos)66 dns_iptable_addprefix(dns_iptable_t *tab, isc_netaddr_t *addr,
67 isc_uint16_t bitlen, isc_boolean_t pos)
68 {
69 isc_result_t result;
70 isc_prefix_t pfx;
71 isc_radix_node_t *node = NULL;
72 int family;
73
74 INSIST(DNS_IPTABLE_VALID(tab));
75 INSIST(tab->radix);
76
77 NETADDR_TO_PREFIX_T(addr, pfx, bitlen);
78
79 result = isc_radix_insert(tab->radix, &node, NULL, &pfx);
80 if (result != ISC_R_SUCCESS) {
81 isc_refcount_destroy(&pfx.refcount);
82 return(result);
83 }
84
85 /* If a node already contains data, don't overwrite it */
86 family = pfx.family;
87 if (family == AF_UNSPEC) {
88 /* "any" or "none" */
89 INSIST(pfx.bitlen == 0);
90 if (pos) {
91 if (node->data[0] == NULL)
92 node->data[0] = &dns_iptable_pos;
93 if (node->data[1] == NULL)
94 node->data[1] = &dns_iptable_pos;
95 } else {
96 if (node->data[0] == NULL)
97 node->data[0] = &dns_iptable_neg;
98 if (node->data[1] == NULL)
99 node->data[1] = &dns_iptable_neg;
100 }
101 } else {
102 /* any other prefix */
103 if (node->data[ISC_IS6(family)] == NULL) {
104 if (pos)
105 node->data[ISC_IS6(family)] = &dns_iptable_pos;
106 else
107 node->data[ISC_IS6(family)] = &dns_iptable_neg;
108 }
109 }
110
111 isc_refcount_destroy(&pfx.refcount);
112 return (ISC_R_SUCCESS);
113 }
114
115 /*
116 * Merge one IP table into another one.
117 */
118 isc_result_t
dns_iptable_merge(dns_iptable_t * tab,dns_iptable_t * source,isc_boolean_t pos)119 dns_iptable_merge(dns_iptable_t *tab, dns_iptable_t *source, isc_boolean_t pos)
120 {
121 isc_result_t result;
122 isc_radix_node_t *node, *new_node;
123 int max_node = 0;
124
125 RADIX_WALK (source->radix->head, node) {
126 new_node = NULL;
127 result = isc_radix_insert (tab->radix, &new_node, node, NULL);
128
129 if (result != ISC_R_SUCCESS)
130 return(result);
131
132 /*
133 * If we're negating a nested ACL, then we should
134 * reverse the sense of every node. However, this
135 * could lead to a negative node in a nested ACL
136 * becoming a positive match in the parent, which
137 * could be a security risk. To prevent this, we
138 * just leave the negative nodes negative.
139 */
140 if (!pos) {
141 if (node->data[0] &&
142 *(isc_boolean_t *) node->data[0] == ISC_TRUE)
143 new_node->data[0] = &dns_iptable_neg;
144
145 if (node->data[1] &&
146 *(isc_boolean_t *) node->data[1] == ISC_TRUE)
147 new_node->data[1] = &dns_iptable_neg;
148 }
149
150 if (node->node_num[0] > max_node)
151 max_node = node->node_num[0];
152 if (node->node_num[1] > max_node)
153 max_node = node->node_num[1];
154 } RADIX_WALK_END;
155
156 tab->radix->num_added_node += max_node;
157 return (ISC_R_SUCCESS);
158 }
159
160 void
dns_iptable_attach(dns_iptable_t * source,dns_iptable_t ** target)161 dns_iptable_attach(dns_iptable_t *source, dns_iptable_t **target) {
162 REQUIRE(DNS_IPTABLE_VALID(source));
163 isc_refcount_increment(&source->refcount, NULL);
164 *target = source;
165 }
166
167 void
dns_iptable_detach(dns_iptable_t ** tabp)168 dns_iptable_detach(dns_iptable_t **tabp) {
169 dns_iptable_t *tab = *tabp;
170 unsigned int refs;
171 REQUIRE(DNS_IPTABLE_VALID(tab));
172 isc_refcount_decrement(&tab->refcount, &refs);
173 if (refs == 0)
174 destroy_iptable(tab);
175 *tabp = NULL;
176 }
177
178 static void
destroy_iptable(dns_iptable_t * dtab)179 destroy_iptable(dns_iptable_t *dtab) {
180
181 REQUIRE(DNS_IPTABLE_VALID(dtab));
182
183 if (dtab->radix != NULL) {
184 isc_radix_destroy(dtab->radix, NULL);
185 dtab->radix = NULL;
186 }
187
188 isc_refcount_destroy(&dtab->refcount);
189 dtab->magic = 0;
190 isc_mem_putanddetach(&dtab->mctx, dtab, sizeof(*dtab));
191 }
192